CVE-2019-5480: Path Traversal in statichttpserver
Summary
CVE-2019-5480: Path Traversal in statichttpserver. Affects statichttpserver versions < 0.9.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The statichttpserver package is an npm package that provides a simple HTTP server for serving static files. It allows developers to quickly set up a server to serve files from a specified folder. However, all versions of statichttpserver are vulnerable to Path Traversal. This means that the package fails to properly sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.
Vulnerability Detail
The Path Traversal vulnerability in statichttpserver arises from the package's failure to sanitize URLs. Attackers can exploit this vulnerability by crafting malicious requests that include relative paths to access sensitive files on the server. This can lead to unauthorized access to confidential information or the execution of arbitrary code. The vulnerability has been assigned a severity level of CRITICAL and is classified under CWE-22.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, a possible workaround is to manually sanitize the URLs before passing them to the statichttpserver package. This can be done by validating and normalizing the paths to ensure they only access files within the intended folder.
Conclusion
The statichttpserver package is vulnerable to a Path Traversal vulnerability that allows attackers to access server files outside of the served folder. Currently, there is no fix available, and it is recommended to use an alternative package until a fix is released. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for statichttpserver →
FAQ
This vulnerability allows attackers to access server files outside of the served folder, potentially leading to unauthorized access to sensitive information or the execution of arbitrary code.
No, there is currently no fix available for this vulnerability. It is recommended to use an alternative package until a fix is released.
Path Traversal is a vulnerability that allows attackers to access files or directories outside of the intended scope by manipulating file paths.
This vulnerability has been assigned a severity level of CRITICAL.
There are no known public exploits for this vulnerability at the moment.
